topic Re: Traffic logs not shown the recent logs for particular source IP in General Topics

Traffic logs not shown the recent logs for particular source IP

MohammedAsik — Thu, 26 Nov 2020 14:59:39 GMT

Hi Guys

One of our customer facing issue that unable to see recent traffic logs for particular source and destination in gui. But we could see the live session on cli by the command "show session all filter source 192.168.x.X destination 172.17.X.X".

Session working as expected. but we need to see the traffic logs on gui. restarted the mgmt server but no luck. anyone facing this kind of issue. please share your thoughts

Regards

Mohammed Asik

Re: Traffic logs not shown the recent logs for particular source IP

SutareMayur — Fri, 27 Nov 2020 05:10:17 GMT

Hi @MohammedAsik ,

Just to confirm again, Is it happening for given specific source & IP addresses or you're not able to see traffic logs for all the traffic? If this is for only specific source & destination, please check if Log at Session Start and/or Log at Session End is enabled under Security Policy which is allowing this traffic. At least, Log at Session End should be is selected.

Hope it helps!

Mayur

Re: Traffic logs not shown the recent logs for particular source IP

MohammedAsik — Fri, 27 Nov 2020 06:31:58 GMT

HI Mayur

Yes, Its happening only for specific source and destination. log session end and start were enabled on security policy.

One more time I explain you clearly. I have one security rule that contains 5 source ips from trust zone and one destination ip from another local zone. For 2 src IPs we haven't see the logs in Gu but for other 3 Ip's we are able see the logs which are in same security rule.

For those 2 src IP's traffic logs were received one day before.

Is there any process need to restart to to fix this issue ?

Regards

Mohammed Asik

Re: Traffic logs not shown the recent logs for particular source IP

jambulo — Fri, 27 Nov 2020 18:33:41 GMT

We recently ran into a bug where the Palo was not logging some traffic if it hit a rule that did not have Zones defined. Does your security rule happen to not have Zones defined?

Re: Traffic logs not shown the recent logs for particular source IP

MohammedAsik — Mon, 30 Nov 2020 09:16:22 GMT

No, In security rule zones are defined

Regards

Mohammed Asik

Re: Traffic logs not shown the recent logs for particular source IP

MohammedAsik — Fri, 04 Dec 2020 06:48:03 GMT

Hi Guys

I have found the issue. Old session not get deleted. After I cleared the existing session ID by clear session id, firewall creates the new session and its created the logs in GUI

Now issue has been resolved. Thank you all

Regards

Mohammed Asik